ANS-C01 Network Security, Compliance and Governance Practice Question
A security team needs to block outbound traffic from an EC2 instance to known malicious IP addresses while allowing all other outbound traffic. Which THREE steps should be taken? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Update the VPC route table to send traffic for the malicious IPs to a network firewall appliance.
The correct approach to block outbound traffic to known malicious IPs involves a combination of routing and stateful firewall inspection. Option B is correct because updating the VPC route table to send traffic for the malicious IPs to a network firewall appliance (e.g., AWS Network Firewall) enables centralized inspection and blocking. Option C is correct because deploying AWS Network Firewall provides stateful, application-layer inspection that can handle allow/deny rules for specific IPs. Option D is correct because a firewall rule within AWS Network Firewall can explicitly deny traffic to the malicious IPs. Option A is incorrect because network ACLs are stateless and require individual rules for each IP, making them impractical for dynamic blocklists. Option E is incorrect because security groups support only allow rules, not explicit deny; they cannot block specific IPs outbound.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure network ACLs to deny outbound traffic to the malicious IPs.
Why it's wrong here
Configuring network ACLs to deny outbound traffic to malicious IPs is incorrect because network ACLs operate at the subnet level and are stateless. While they can deny outbound traffic, they apply to all instances within the subnet, not just a specific EC2 instance, making them less granular for instance-specific controls. This option is tempting because network ACLs *can* indeed deny traffic by IP address and are a valid network security layer. They are best suited for broad, stateless filtering at the subnet boundary, such as blocking an entire range of suspicious IPs from accessing a whole subnet.
- ✓
Update the VPC route table to send traffic for the malicious IPs to a network firewall appliance.
Why this is correct
Correct: Route traffic to firewall for inspection.
- ✓
Deploy AWS Network Firewall in the VPC to perform stateful inspection.
Why this is correct
Correct: AWS Network Firewall can block specific IPs.
- ✓
Create a firewall rule in AWS Network Firewall that denies traffic to the malicious IPs.
Why this is correct
Correct: The firewall rule denies traffic to listed IPs.
- ✗
Modify the security group for the EC2 instance to deny outbound traffic to the malicious IPs.
Why it's wrong here
Wrong: Security groups cannot block individual IPs in outbound rules; they allow/deny based on CIDR.
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to block outgoing traffic from a specific EC2 instance to the internet, except for HTTPS traffic to a specific API endpoint. Which AWS service can enforce this at the instance level?
easy- A.AWS WAF
- B.Network ACL
- C.Security group with outbound rules
- ✓ D.AWS Network Firewall
Why D: AWS Network Firewall can be deployed in the VPC to filter outbound traffic based on domain names. Option A (AWS WAF) is wrong because it works at the application layer for inbound web traffic and does not block outbound traffic at the instance level. Option B (Network ACL) is wrong because NACLs are stateless and work at the subnet level. Option C (Security group with outbound rules) is wrong because security groups do not support allowlisting based on domain names.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.